Re: Apple Mac G5 or G4 dual-cpu

2005-10-04 Thread Dries Schellekens
Theo de Raadt wrote: We would love it if someone is able to supply one or our developers in the Netherlands with a dual-cpu Mac. It does not matter if it is G4 or G5, either will do. If anyone can, please drop me a note. Thanks. So SMP is next on the list of Mark Kettenis after G5 support?

Re: Wasting our Freedom

2007-09-17 Thread Dries Schellekens
2007/9/18, Can E. Acar [EMAIL PROTECTED]: Theodore Tso wrote: Number 2, if you take a look at their latest set of changes (which have still not been accepted), the HAL code is under a pure BSD license (ath5k_hw.c). Other portions are dual licensed, but not the HAL --- if people would

Re: NIC bonding/trunking/802.3ad

2005-05-25 Thread Dries Schellekens
Niall O'Higgins wrote: On Tue, May 24, 2005 at 02:01:23PM +0100, Hyb wrote: It seems that the topic of 802.3ad support (link aggregation|bonding|trunking|whatever you want to call it) seems to come every so often, but is often disregarded on the basis that gigE is now cheap. I see the

Re: Your worst dream comes true, thanks to Intel

2005-05-31 Thread Dries Schellekens
Constantine A. Murenin wrote: 2002: http://www.theinquirer.net/?article=5858 http://www.gnu.org/philosophy/can-you-trust.html etc I don't get what this (TCPA now known as TCG) has to do with new Intel products. This is completely unrelated. A TPM (trusted platform module) is not going to

Re: Your worst dream comes true, thanks to Intel

2005-05-31 Thread Dries Schellekens
T. Ribbrock wrote: According to this German site (haven't found an English source yet) http://www.golem.de/0505/38320.html Intel has denied that the 945 had DRM built-in. They say that it only has the option to connect Trusted Platform Modules to it, which - according to Intel - is not news,

isakmp implementation vulnerabilities

2005-11-14 Thread Dries Schellekens
Hey, Just saw this: http://www.niscc.gov.uk/niscc/docs/re-20051114-01014.pdf Has the isakmpd(8) been tested by the PROTOS test? This test suite (Java program) is available publicly at http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp/ Cheers, Dries

Re: isakmp implementation vulnerabilities

2005-11-15 Thread Dries Schellekens
Chad Loder wrote: I just tested our isakmpd(8) implementation against the PROTOS test suite. No problems were detected. We performed an audit of isakmpd's IKE parsing code back in early 2004 and made several fixes (OpenBSD 3.4 timeframe). I guess you are referring to errata 015 of OpenBSD

Re: DHS Grant to analye OpenBSD (and other OSS) for Bugs

2006-01-11 Thread Dries Schellekens
Axton wrote: First post here, not sure if this is the right forum. Let me know if not. From the article: The U.S. Department of Homeland Security is extending the scope of its protection to open-source software. ... The list of open-source projects that Stanford and Coverity plan to check

Re: MS Security VP Mike Nash remarks on MS vs OpenBSD security.

2006-01-26 Thread Dries Schellekens
fox wrote: Second, it is not completely accurate to say that OpenBSD is more secure. If you compare vulnerability counts just from the last 3 months, OpenBSD had 79 for November, December and January compared to 11 for Microsoft (and that includes one each for Office and Exchange - so really 9

Re: Missing patch and security announce

2006-01-26 Thread Dries Schellekens
Rob W wrote: What about http://www.securityfocus.com/bid/16375 Fixed in -current, 3.8-stable and 3.7-stable See http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pf_norm.c Cheers, Dries

Re: MS Security VP Mike Nash remarks on MS vs OpenBSD security.

2006-01-26 Thread Dries Schellekens
Rob W wrote: What about http://www.securityfocus.com/bid/16375 and http://docs.freebsd.org/cgi/mid.cgi?200601251013.k0PAD9lO059018 (Fixed in cvs, but NO patch for 3.8 or 3.7 and NO security announce - http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/if_bridge.c.diff?r1=1.147r2=1.148)

Re: OpenBSD PF IP Fragment Remote Denial Of Service

2006-02-01 Thread Dries Schellekens
Subcommander l0r3zz wrote: This came across security focus and I haven't seen it mentioned here. THey claim 3.8 is vulnerable, anybody know anything? This has been fixed in -current, 3.8-stable and 3.7-stable. This crash only works if you have 'scrub fragment crop' or 'scrub fragment

Re: NIC's with 3DES

2006-02-14 Thread Dries Schellekens
edgarz wrote: I want to ask about NIC's with built in 3DES support, in my situation Intel Pro 100 (Intel 82557). Is that 3DES support usable with OpenBSD + isakmpd? No. See http://www.openbsd.org/crypto.html#hardware Idem for 3com NIC. Cheers, Dries

Re: bcw(4) is gone

2007-04-05 Thread Dries Schellekens
Andris Delfino wrote: Yes, and he was wrong. He shouldn't base his work in copylefted software (if he intend to release the result as non-copylefted). Licenses are licenses. Yes, Marcus made a mistake. But not the mistake this GPL zealots seem to think (not knowing that copying GPL code is

Re: serious weakness in OpenBSD's PRNG

2008-02-07 Thread Dries Schellekens
On Feb 6, 2008 8:31 PM, Nikns Siankin [EMAIL PROTECTED] wrote: The full paper is available at the following URL: http://www.trusteer.com/docs/dnsopenbsd.html I find the the fixes done in other BSDs rather ugly because they have to keep a lot of state information: *

Re: 4.1 Hacked? Some interesting hashes

2008-02-11 Thread Dries Schellekens
On Feb 11, 2008 1:34 PM, Manuel Ravasio [EMAIL PROTECTED] wrote: What I'm still missing is the relationship (if any) between a couple of hashes and a possible breach in OBSD... Supposedly these are the hashes of tarball containing exploit code/binary for a security hole in OpenSSH shipped

Re: FOSDEM 23/24 Feb Brussels

2008-02-22 Thread Dries Schellekens
On Fri, Feb 22, 2008 at 4:12 PM, Andri Braselmann [EMAIL PROTECTED] wrote: AND the most signifant part of this country is: The highways used to be illuminated at night with a terrible orange light. We did that such that people in space can locate Belgium. The Chinese have their wall for

Re: HP HC340T pci-x card

2006-05-23 Thread Dries Schellekens
holger glaess wrote: i try to install this quad pci-x ethernet card that looks like an intel from hp. in my starting dmesg i got ppb3 at pci3 dev1 function 0 unknown vendor 0x12d8 product 0x01a7 rev 0x01 pci 4 at ppb3 bus 4 vendor Intel, unknown product 0x10b5 (class network subclass

Re: intel PRO wireless 3945ABG

2006-05-29 Thread Dries Schellekens
akonsu wrote: hello, i am looking for help getting the intel pro wireless 3945ABG adapter work with release 3.9. i know that there is a driver for it but i do not think it is present in this release. i think i need to build everything from source (which i am trying to avoid). is this correct? i

Re: intel PRO wireless 3945ABG

2006-05-29 Thread Dries Schellekens
Dries Schellekens wrote: The wpi(4) driver was added post 3.9. http://www.openbsd.org/cgi-bin/man.cgi?query=wpisektion=4 Try a snapshot. Kerneltrap has a nice article about this new driver: http://kerneltrap.org/node/6650 Cheers, Dries

Re: Xen/OpenBSD Summer of Code project

2006-05-30 Thread Dries Schellekens
Anil Madhavapeddy wrote: We've put up some Xen-related projects for the Google Summer of Code, and one of them of particular interest is a port of OpenBSD to Xen 3.0 as a native guest OS. Full list: http://www.xensource.com/summerofcode.html Interested hackers are encouraged to apply; it is a

Re: Xen/OpenBSD Summer of Code project

2006-05-30 Thread Dries Schellekens
instance (or even multiple of them) will run in parallel to the OpenBSD domain. Cheers, Dries On 5/30/06, Dries Schellekens [EMAIL PROTECTED] wrote: Anil Madhavapeddy wrote: We've put up some Xen-related projects for the Google Summer of Code, and one of them of particular interest is a port

Re: Xen/OpenBSD Summer of Code project

2006-05-30 Thread Dries Schellekens
/minimal, and not a complete Linux/NetBSD/... like it is the case now, to keep the size of the TCB smaller. Cheers, Dries On 5/30/06, Dries Schellekens [EMAIL PROTECTED] wrote: Peter Blair wrote: That project (if/once completed) would be very useful. I just cringe at the thought of running

Re: license for getopt.c?

2006-05-31 Thread Dries Schellekens
Will H. Backman wrote: While wandering through the usr.bin source tree (not to imply that I am qualified to take the journey), I noticed that getopt.c doesn't have a license clause in it. Anyone know who david might be? david@ = David Krause Cheers, Dries

Re: dynamic dns update

2006-06-02 Thread Dries Schellekens
riwanlky wrote: I will like to know if OpenBSD have the capability to update my dynamic ip to www.dyndns.org. I am currently running myDYNIPPRO on Windows to update my dynamic ip. I want to move to OpenBSD. I had currently running sendmail, popa3d, mrtg, mySQL on the machine. There is

Re: Wireless card use

2006-06-08 Thread Dries Schellekens
Jonathan Gray wrote: The third is based on a TI ACX chip which can be picked by its blue PCB. http://kbserver.netgear.com/products/WG311v3.asp Is this likely to be supported by OpenBSD? Is TI still refusing to permit the distribution of the firmware blob? Linux people seem to have figured

Re: new port: OpenBSD/aviion

2006-06-08 Thread Dries Schellekens
Miod Vallat wrote: I would like to extend the hardware coverage of this port by supporting more models and more on-board devices. But as long as I do not have AViiON hardware and rely on other people for testing, development will not progress very fast, and will hit on our nerves. So if you

Re: VIA C7 hardware AES support in IPSEC(ctl)

2006-06-21 Thread Dries Schellekens
Bihlmaier Andreas wrote: ## openssl speed aes-128-cbc type 16 bytes 64 bytes256 bytes 1024 bytes 8192 bytes aes-128 cbc 17311.15k18319.00k18569.35k18893.09k 18765.02k ## openssl speed aes-256-cbc type 16 bytes 64 bytes256 bytes

Re: VIA C7 hardware AES support in IPSEC(ctl)

2006-06-21 Thread Dries Schellekens
Bihlmaier Andreas wrote: I dont mean to offend you, but ... Doh, I know that and these are VERY nice figures, BUT my problem is that I have to slow (== no acceleration) speed in IPSEC. I thought that OPenBSD would just make use of it (again in IPSEC) if it detects it. IPSEC always uses the

Re: VIA C7 hardware AES support in IPSEC(ctl)

2006-06-21 Thread Dries Schellekens
Bihlmaier Andreas wrote: I use iperf -w 256k for testing purposes. The speed between hosts/router using their real IPs (-B 10.0.0.*) is about 70-80 Mb/s. ~22 Mb/s between host1 and host2 using their VPN IPs. Hope this made some stuff more clear. Thanks everyone for helping, I hope this can

Re: Doubts about OpenBSD security.

2006-06-21 Thread Dries Schellekens
Joco Salvatti wrote: Let's suppose an attacker entered the room where an OpenBSD server is located in, and by mistake the system administrator has forgotten to logout the root login session. So the attacker could enter in single user mode, without the need for the root password, and load a

Re: ifconfig -l feature

2006-06-21 Thread Dries Schellekens
Douglas Santos wrote: You are a joke Pedro Martelletto. You are the person adding a stupid extra flag to ifconfig, while Pedro is working on very useful stuff like VFS and file system support. Cheers, Dries

Re: VIA C7 hardware AES support in IPSEC(ctl)

2006-06-22 Thread Dries Schellekens
Bihlmaier Andreas wrote: My problem with the speed is that compared to the performance I get out of openssl (by USERcrypto) the IPSEC (in kernel) performance is terrible. AFAIK right now it doesn't even make use of the crypto hardware because I can get the same throughput with a comparable

Re: VIA C7 hardware AES support in IPSEC(ctl)

2006-06-22 Thread Dries Schellekens
Dries Schellekens wrote: As I say earlier, the hardware is working, but the performance bottleneck is elsewhere (presumably kernel crypto framework). Sam Leffler of FreeBSD did some work in improving the performance of the OpenBSD kernel crypto framework: http://www.usenix.org/event

Re: VIA C7 hardware AES support in IPSEC(ctl)

2006-06-22 Thread Dries Schellekens
Bihlmaier Andreas wrote: As I say earlier, the hardware is working, but the performance bottleneck is elsewhere (presumably kernel crypto framework). I'm sorry, I didn't get it the first time, but I get it know :) This is what I was seeking for, an answer. Now I have to greatly improve my C

Re: crypto: available ciphers

2006-08-19 Thread Dries Schellekens
Chris Cappuccio wrote: Plenty of algorithms that are used in OpenBSD and other free systems are patented. Who cares? Which? IDEA crosses my mind, but that is it. AES, DES, RSA, Blowfish, SHA-1/2 are all not patented. Cheers, Dries

Re: Fuzzy patching broken?

2006-09-04 Thread Dries Schellekens
to reproduce the problem. Thanks for paying attention and reporting this. demime removed the file Cheers, Dries -- Dries Schellekens email: [EMAIL PROTECTED]

Re: update automaticly

2006-10-19 Thread Dries Schellekens
sonjaya wrote: i have script for update automaticly here: # cat /root/update_part1.sh #!/bin/csh cd /usr/src setenv CVS_CLIENT_PORT -1 setenv CVSROOT [EMAIL PROTECTED]:/cvs cvs -d $CVSROOT -q up -rOPENBSD_3_9 -Pd date /root/update_part1.log when i try run that script get error such like this :

Re: Another BLOB?

2006-10-20 Thread Dries Schellekens
Alexey Suslikov wrote: Looks like FreeBSD is helping massively to make our world more BLOBby... http://bsdblogs.droso.org/netchild/2006/10/19/native-realplayer-for-freebsd/ I don't see what this has to do by blobs in drivers? There is nothing wrong the closed source software. You can even

Re: OpenBSD / NetBSD systrace kernel integer overflow

2006-10-24 Thread Dries Schellekens
Nicolas Martzel wrote: http://scary.beasts.org/security/CESA-2006-003.html Feedback about that ? Corrected or always active ? http://www.openbsd.org/errata.html#systrace

Re: New tcp stack attack

2008-10-01 Thread Dries Schellekens
On Wed, Oct 1, 2008 at 4:22 PM, Duncan Patton a Campbell [EMAIL PROTECTED] wrote: It seems to me the problem is with SYN cookies. When I read the pseudo article, I had the impression that the server does not have to implement SYN cookies. Their sockstress program uses (client) SYN cookies to

Re: New tcp stack attack

2008-10-08 Thread Dries Schellekens
On Wed, Oct 1, 2008 at 4:47 PM, Dries Schellekens [EMAIL PROTECTED] wrote: When I read the pseudo article, I had the impression that the server does not have to implement SYN cookies. Their sockstress program uses (client) SYN cookies to estabilish a lot of TCP connections with minimal own